Provides virtual credit cards for payment masking for roughly $1/month/card.
Why I think this tool should be added
I think it is unique because these cards are essentially prepaid, in the sense that they don’t pull directly from your bank account for transactions. It’s also the only solution available globally, I’m not quite sure how they do that.
This tool has its own post in the project showcase here, but I wanted this post separate mainly to collect any potential objections/notes specifically about adding it to the site. If you just have a question about Halocard though, it’d be best to reply there instead:
I’m not a KYC guru. I know some of you are. Im hoping one of you experts can weigh in on their choice for a KYC provider, Sumsub.
I made some comments on their privacy policy in the existing thread, Ed provided a strong response, but I would still value input from a third party
Keep in mind, this is not an anonymous payment tool. It is a privacy tool meant to keep your PII private from intermediate merchants. Holocard will need your PII to comply with the law. I’m moreso looking to explore the privacy implications of thr third-party KYC provider they selected, as compared to other options in this space, of which I have absolutely no expertise
Allows the creation of multiple cards which function as a shield between the merchant and your personal finances.
Cards must not require you to provide accurate billing address information to the merchant.
It definitely fits the baseline criteria. The developer said it had to be vetted by banks many times, so that’s something.
I’d be interested in the developer sharing more information about security practices.
Afaik it’s web based so that’s good for people that prefer not to use apps.
Are we allowed to question things not in the guidelines? Like website trackers? Seems to have trackers. On the pages that I visited, it doesn’t ask for HTML5 canvas image, which many banking websites ask for.
Is the business side sustainable? This would be listed a lot sooner from creation date than privacy.com which was created in 2014.
Seems significantly more expensive than privacy.com for any degree of serious usage. Not a reason to not recommend it, but probably important to keep in mind.
Firstly, I wanted to thank you very much for nominating us for the recommended tools list. It’s not lost on me the responsibility this carries to maintain the trust and integrity you’ve built across the community. I like to think we’ve been very transparent thus far and will continue to be so to address your questions:
Sure. At a high level:
We do not store user data on our servers
Two-factor authentication (2FA) is required for all accounts
All development follows OWASP Secure Design Principles and is audited annually
We’ve been around since 2024 and recently become profitable. No external financing to date, nor is it planned or needed.
@jonah There is a very clean separation between what frameworks we use on our external marketing website (halocard.co) versus our virtual card platform.
Our virtual card platform is private and does not employ any tracking tools. We do use Mixpanel (as disclosed in our privacy policy) to record user behaviour so we can identify bugs and help users who get stuck. For example, if someone is rage clicking a button that isn’t working as intended, we’re notified so we can help them and fix the UI to make the product better so all subsequent users experience less friction.
Our external marketing website is not designed to be private. When you run an online business, you know just how important it is to be found and measure how effectively you convert traffic into users. We use Google Analytics 4 to measure this and Microsoft Clarity to see how traffic converts and where we need to improve.
@overdrawn98901 Notwithstanding the fact both tools are only present on our external marketing website and both can be easily blocked at the browser level, I understand the concern.
If the community has better alternatives they can suggest that fulfil our objectives, we’d happily consider them and would prefer to support more privacy-focussed options, as long as they still make commercial sense… Please let me know!
I’ve been a user of halocard for a bit (think it’s been a few months now) and there’s been nothing too crazy, +1 to adding it to PG’s recommendation list, their support peoples are great
I should say adding first party analytics is a nice to have - definitely is a lot more effort to add them in house and maintain so I understand the need to not focus on that ASAP.
But anything self hosted on your end means you own the analytics E2E. I can spitball names like Signoz for operational metrics, or maybe Plausible for a mostly similar web analytics as Google.
But honestly this highlights a gap in PG I think could be super useful - privacy respecting ways to build online businesses. Like Plausible seems pretty good, but this isn’t an end user targetted focus.
Really appreciate the suggestion. We went deep on a bunch of tools the last few days and Plausible seems to be the most functional and privacy-preserving option.
We’ve now paused GA4 & MS Clarity and set Plausible live on our external marketing website.
@jonah & @overdrawn98901: If you’d like to verify this new setup is active on the client-side and more privacy-preserving than before, that’d be greatly appreciated.
First of all, I’m quite surprised in how fast of a turnaround you made! Forget smaller more focused companies can make changes fast.
Went to your site (below), and all seem to be first-party requests which I presume are then routing to your Plausible instances to what is provided by plausible (unless there is some other marketing site I’m unaware of).
I’m hoping Plausible works well for you. If its the case, perhaps you could also make a Tool Suggestion for PG about your use case I think there should be a dedicated “business” section in the PG recommendations to assist with these questions.
Yes, exactly that. Sounds like youve done research in other competitors which might be useful to include for reasons to why you chose it. However before asking you to create a site suggestion, I’ll ask @team if such a request would even be approved for non end-user focused tools but rather business focused privacy tools.
Re. sumsub, looks quite sketchy. Well they did a pretty good job of covering up the founder and his twin brothers past work and seeing as though they (halocard) send them all of your bio metrics, selfies, addresses etc.etc.. Its good to look into.. Turns out his in Israel:
Where is Andrew Sever based?
Andrew Sever is based out of Tel Aviv District, Israel.
The weight of ‘jurisdictional shopping’ on privacy is a debatable topic. Ive seen it discussed on PG before, struggling to find a good source to link. Geopolitical considerations are a meaningful, but separate discussion
While it is interesting - and from what I can tell, true - that SumSub’s founder is based in Israel, the company itself does appear to be UK-based
I think there should be a dedicated “business” section in the PG recommendations to assist with these questions.